crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec

A flaw was found in the Golang crypto/internal/nistec package. Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Considering how this function is used, this leaka...

attack-surface

ASP — Public Network Attack Surface Automation Mapping and Vul...

Exploit for CVE-2026-44840

CVE-2026-44840 — PoC: Dgraph DQL Injection via checkUserPassw...

EUVD-2026-81291

Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning that Craft is not installed, which makes anonymous installer actions — including install/validate-site — reachable on an installed production site whenever PHP remains available but the configured MySQL endpoint does...

PT-2026-95105

Name of the Vulnerable Software and Affected Versions Caddy Proxy Manager versions prior to 1.5.1 Description Caddy Proxy Manager allows unauthenticated remote actors to create active accounts with the user role without administrator approval. This occurs because email and password...

PT-2026-94389

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions prior to 9.18 Description The Restore and Maintenance tools pass the client-supplied database field directly as the value of the --dbname option for pg restore and psql. Because libpq expands database names containing an...

PT-2026-94576

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the nvmet execute identify ns zns function. This happens when a host sends an Identify command with CNS 05h and CSI 02h ZNS targeting a file-backed...

PT-2026-94422

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A signed overflow occurs in the fq pie init function when the default quantum is set using psched mtu without clamping. On devices with an exceptionally large Maximum Transmission Unit...

CVE-2026-15815: Improper Link Resolution Before File Access

Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation directory, writing arbitrary files and an executable backend binary outside that directory...

CVE-2026-86862: Improper Neutralization of Argument Delimiters in a Command

pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbname option given to pgrestore and psql. libpq expands a database name containing an equals sign into a full connection string, and connection keywords embedded in that value tak...

CVE-2026-86864: Improper Neutralization of Argument Delimiters in a Command

pgAdmin 4's Backup tool appended the client-supplied 'database' field from the /backup/job/ /object request to the pgdump argument vector as a bare trailing positional argument, without validation. Because pgdump parses its options with getoptlong, which permutes arguments, a value beginning with...

PT-2026-94621

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the coresight etm4x component during the perf enable path. The system fails to call the cscfg csdev disable active config function in specific error scenarios, such as...

PT-2026-94568

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ALSA sequencer where the bounce error event function leaks a kernel memory address to userspace. When a queued variable-length event fails, the data.ext.ptr variab...

Empirical Analysis of Randomness Quality in Differential Privacy Mechanisms

Differential Privacy DP relies on carefully calibrated random noise to protect individual privacy in statistical analyses. While theoretical work has analyzed DP under weakened randomness assumptions, the practical consequences of entropy degradation remain poorly understood. We present a...

CVE-2026-90120: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v5: Check getlogicalindex return value in MADT IAFFID parsing In gicacpiparseiaffid a given MADT GICC entry might not correspond to a logical cpu recognized by the kernel, resulting in the cpu variable initialization ...

CVE-2026-90100: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ptp: netc: fix period truncation and potential divide-by-zero in PEROUT The maxperiod bound in nettimerenableperout was computed as: maxperiod = u64NETCTMRDEFAULTFIPER + integralperiod; which exceeds U32MAX when integralperiod 0...

CVE-2026-90220: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Don't leak the extension cell pointer in the bounce payload The bounceerrorevent embeds the failed event in the bounce payload by pointing data.ext.ptr at it. When that event is a queued variable-length event, its own...

PT-2026-94522

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A slab-out-of-bounds read exists in the ksmbd alloc user function. The issue occurs because the function uses the hash sz variable, provided by a mountd IPC login response, to determine...

PT-2026-94599

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth MSFT implementation where the read supported features function fails to properly validate the evt prefix len variable against the actual response length...

PT-2026-94670

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the OCFS2 cluster component where the o2nm node local store function fails to clear the cl has local variable when handling local=0. This creates a stale state that...